The black-box attack is applied to recover images of four standard CNN benchmark datasets: CIFAR10, MNIST, CELEBA, and Stanford CAR. More specifically, we trained MNIST using LeNet, which is a small CNN composed of 2 convolutional and 3 fully connected layers. CIFAR10 dataset is trained with a larger CNN (6 convolutional and 2 fully connected layers), VGG19 (16 convolutional and 3 fully connected layers) is applied to CELEBA, and VGG16 (13 convolutional and 3 fully connected layers) to Stanford CAR. In our experiments, we follow the CIFAR, MNIST, CELEBA, and CAR dataset split standard for training and testing and we choose ADAM as optimizer, as done in [1]}. Figure REF  presents the inversion results of different black-box attack scenarios. ReLU \(ij\)  in the figure indicates the \(j\)  ReLU in the \(i\)  block of the CNN (e.g. ReLU 11 is the first ReLU in the first block.). Without loss of generality, we illustrate the recovered data of layers where the number of filters changes (e.g., conv22/ReLU22 of CIFAR CNN receives 64 feature maps and outputs 128 feature maps). In addition, we present examples of recovered images, if a participant only receives few filters. Accordingly, Table REF  presents the similarity level between the original samples and the recovered data, when applying black-box attacks on different datasets and under different splitting scenarios. In this paper, we use the average Structural Similarity Index (SSIM) as a metric that measures the quality degradation of the reversed data compared to the original one.
<TABLE>